Skip to content

Major release, v3.0.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Apr 00:56
· 16 commits to main since this release
v3.0.0
8820152
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Pika v3.0.0

A ground-up rebuild. The entire frontend has been rewritten in React 19, links now expire, and the stack is hardened from top to bottom.

✨ What's New

React 19 Frontend

The vanilla JS frontend is gone — Pika now runs on React 19 + Vite, bringing a modern component architecture, faster builds, and a much better developer experience.

🎨 Woodland Cozy Design

A brand-new visual identity featuring a warm terracotta & cream palette, smooth animations, and a fully responsive mobile-first layout. Dark and light modes are built in, with QR codes that regenerate their colors on theme toggle.

⏳ Link Expiration

Links are no longer permanent by default. Choose from 1 hour, 12 hours, 1 day, 7 days (default), or never — expired records are automatically cleaned up and their keywords freed for reuse.

🔔 Toast Notifications

A polished notification system with contextual colors for success, error, warning, and info states. Anchored bottom-right on desktop, centered on mobile.

🛡️ Admin Panel Upgrades

The admin table now displays created and expires timestamps with color-coded badges for at-a-glance status.

🔒 Security Hardening

  • Removed plaintext password logging — print(new_password) leak in cred.py is gone
  • Specific exception handling — bare except replaced with targeted argon2 exceptions
  • Startup validation — server refuses to start if SECRET_KEY or BEARER_TOKEN are unset
  • Race condition prevention — UNIQUE constraint on urls.short
  • Redirect scheme validation — only https:// and http:// URLs are followed
  • Negative expiry rejection — invalid expiry values are no longer accepted
  • Secrets file permissions — .env files now use chmod 600 instead of 777
  • CORS lockdown — removed nginx wildcard * that overrode backend CORS policy

🐛 Bug Fixes

Backend

  • custom_keyword.strip() return value was silently discarded
  • Custom keyword duplicate check compared short to itself instead of the original URL
  • Dictionary exhaustion crashed the server — now returns 503 Service Unavailable
  • Expired records blocked reuse of their keywords
  • exit() after DB init killed the container on first run
  • Missing is_reset_password.txt caused a crash on fresh installs
  • Password reset now uses change_cred() instead of dropping the login table
  • GetRecordsSchemas.records type corrected from dict to list[dict]
  • URL space validation added to the API
  • Typo: "sucessfully" → "successfully"

Frontend

  • Safari SVG blur caused by image-rendering: pixelated
  • Clipboard copy failures were silently swallowed
  • Logo click now resets home page state (clears QR / results)
  • QR code and copy button icon scale properly on small screens
  • Config cache is cleared on fetch failure to allow retry
  • Placeholder text no longer suggests hyphens that the regex rejects
  • adminCheck failure in ChangePassword no longer causes an infinite spinner

Infrastructure

  • setup.sh: fixed WEB_EXPOSED_PORT space-after-equals bug
  • setup.sh: .env files are now overwritten instead of appending duplicates
  • setup.sh: docker availability check moved before password-reset block
  • Removed deprecated version field from docker-compose.yaml
  • nginx: added try_files for SPA client-side routing
  • Removed non-existent packages from requirements.txt and package.json
  • GitHub Actions: fixed extglob syntax so !(pika) pattern parses correctly

⚠️ Breaking Changes

Change Migration
API path /api/v2 → /api/v3 Update any external integrations or bookmarks
New DB columns created_at, expires_at Requires database re-initialization
Vanilla JS frontend removed No action needed — the React build replaces it

📝 Docs

  • Updated README content and license year
  • Renamed README_zh-tw.md → README.zh-tw.md for consistency
Assets 3
Loading